Author: brooks
Date: Mon Apr 24 22:44:59 2017
New Revision: 317392
URL: https://svnweb.freebsd.org/changeset/base/317392
Log:
MFC r316768:
Fix an out-of-bounds write when a zero-length buffer is passed.
Found with ttyname_test and CHERI bounds checking.
Reviewed by: emaste
Obtained from: CheriBSD
Sponsored by: DARPA, AFRL
Modified:
stable/10/lib/libc/gen/ttyname.c
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/lib/libc/gen/ttyname.c
==============================================================================
--- stable/10/lib/libc/gen/ttyname.c Mon Apr 24 22:37:54 2017
(r317391)
+++ stable/10/lib/libc/gen/ttyname.c Mon Apr 24 22:44:59 2017
(r317392)
@@ -61,6 +61,10 @@ ttyname_r(int fd, char *buf, size_t len)
{
size_t used;
+ /* Don't write off the end of a zero-length buffer. */
+ if (len < 1)
+ return (ERANGE);
+
*buf = '\0';
/* Must be a terminal. */
_______________________________________________
svn-src-stable-10@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10
To unsubscribe, send any mail to "svn-src-stable-10-unsubscr...@freebsd.org"
